lab/iac
1
0
Fork 0
Code Issues 11 Pull requests 3 Projects Releases Packages Wiki Activity Actions

T14: Vault Kubernetes auth backend + per-app VSO roles #30

Open
ginjiruu wants to merge 1 commit from t14-vault-k8s-auth into master
pull from: t14-vault-k8s-auth
merge into: lab:master
Conversation 0 Commits 1 Files changed 9 +217 -6
ginjiruu commented 2026-08-12 15:03:03 +00:00
Owner
Copy link

Closes #29

T14: Vault Kubernetes auth backend + per-app VSO roles

Implements the next step of the ADR-0004 read path: Vault's Kubernetes auth method mounted per cluster, with per-app VaultAuth roles so the Vault Secrets Operator can authenticate as each app's own ServiceAccount.

Deliverables

  1. vault/kubernetes-auth.tf — a vault_auth_backend (type=kubernetes, path kubernetes/<cluster>) + vault_kubernetes_auth_backend_config per cluster in var.kubernetes_auth. The token-reviewer JWTs come from var.kubernetes_token_reviewer_jwts (sensitive; populated from the vault-config-vars Secret via varsFrom — never code). Defaults empty, so the vault-config auto-apply on mini is a no-op until bootstrapped.
  2. Per-app Kubernetes auth roles in vault/modules/app_secrets for every configured cluster backend:
    • <app>-vso → token policy <app>_reader, bound to SA <app>-vso in the app namespace (VSO read path)
    • <app>-esopush → token policy <app>_generated-secret-manager, bound to SA <app>-esopush in flux-system (ESO PushSecret, generated tier)
    • <app>-break-glass → token policy <app>_root, bound to SA <app>-break-glass in flux-system (emergency admin)
  3. <app>_reader policy — read/list over the app's own generated/ + manual/ paths (ADR-0004 A-reader); the app's runtime read path through VSO.
  4. Per-app ServiceAccounts in k8s/modules/tenant: <app>-vso in the app namespace; <app>-esopush and <app>-break-glass in flux-system.
  5. Bug fix: vault/modules/app_secrets identity groups referenced policy names with a trailing -policy that don't exist (policies are ${app}_${capability}). Dropped the suffix.

Bootstrap (per cluster, before enabling)

  1. Create a vault-auth ServiceAccount + ClusterRoleBinding to system:auth-delegator in the cluster.
  2. Add the cluster's API server host, base64 CA cert, and that SA's JWT to the kubernetes_auth / kubernetes_token_reviewer_jwts keys in the vault-config-vars Secret (mini Terraform object varsFrom).

Bootstrap values for mini

  • kubernetes_host: https://10.15.1.170:6443
  • kubernetes_ca_cert: base64 of mini's apiserver CA (~/.kube/mini)
  • token_reviewer_jwt: from the to-be-created vault-auth SA

Out of scope

  • VSO operator install per cluster (shipped separately in lab/clusters PR #1525)
  • Per-app VaultAuth/VaultStaticSecret CRs in the app repos
  • Wiring tofu-controller sync for the k8s/ root (T10, #25)
Closes #29 ## T14: Vault Kubernetes auth backend + per-app VSO roles Implements the next step of the ADR-0004 read path: Vault's Kubernetes auth method mounted per cluster, with per-app `VaultAuth` roles so the Vault Secrets Operator can authenticate as each app's own ServiceAccount. ## Deliverables 1. **`vault/kubernetes-auth.tf`** — a `vault_auth_backend` (`type=kubernetes`, path `kubernetes/<cluster>`) + `vault_kubernetes_auth_backend_config` per cluster in `var.kubernetes_auth`. The token-reviewer JWTs come from `var.kubernetes_token_reviewer_jwts` (sensitive; populated from the `vault-config-vars` Secret via varsFrom — never code). Defaults empty, so the vault-config auto-apply on mini is a no-op until bootstrapped. 2. **Per-app Kubernetes auth roles** in `vault/modules/app_secrets` for every configured cluster backend: - `<app>-vso` → token policy `<app>_reader`, bound to SA `<app>-vso` in the app namespace (VSO read path) - `<app>-esopush` → token policy `<app>_generated-secret-manager`, bound to SA `<app>-esopush` in `flux-system` (ESO PushSecret, generated tier) - `<app>-break-glass` → token policy `<app>_root`, bound to SA `<app>-break-glass` in `flux-system` (emergency admin) 3. **`<app>_reader` policy** — read/list over the app's own `generated/` + `manual/` paths (ADR-0004 `A-reader`); the app's runtime read path through VSO. 4. **Per-app ServiceAccounts** in `k8s/modules/tenant`: `<app>-vso` in the app namespace; `<app>-esopush` and `<app>-break-glass` in `flux-system`. 5. **Bug fix**: `vault/modules/app_secrets` identity groups referenced policy names with a trailing `-policy` that don't exist (policies are `${app}_${capability}`). Dropped the suffix. ## Bootstrap (per cluster, before enabling) 1. Create a `vault-auth` ServiceAccount + ClusterRoleBinding to `system:auth-delegator` in the cluster. 2. Add the cluster's API server host, base64 CA cert, and that SA's JWT to the `kubernetes_auth` / `kubernetes_token_reviewer_jwts` keys in the `vault-config-vars` Secret (mini Terraform object varsFrom). ## Bootstrap values for mini - `kubernetes_host`: `https://10.15.1.170:6443` - `kubernetes_ca_cert`: base64 of mini's apiserver CA (`~/.kube/mini`) - `token_reviewer_jwt`: from the to-be-created `vault-auth` SA ## Out of scope - VSO operator install per cluster (shipped separately in `lab/clusters` PR #1525) - Per-app `VaultAuth`/`VaultStaticSecret` CRs in the app repos - Wiring `tofu-controller` sync for the `k8s/` root (T10, #25) 
Mount vault_kubernetes_auth_backend per cluster (kubernetes/<cluster>) and
generate per-app k8s auth roles (<app>-vso read path, <app>-esopush generated
write, <app>-break-glass admin) from the catalog for each configured backend.
Add the <app>_reader policy (ADR-0004 A-reader) and the per-app vso/esopush/
break-glass ServiceAccounts in k8s/modules/tenant. Fix identity groups
referencing a nonexistent <app>_<capability>-policy name. Bootstrap values
(apiserver host/CA, token-reviewer JWT) come from vault-config-vars via
varsFrom; kubernetes_auth defaults empty so the mini auto-apply is a no-op
until configured.
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin t14-vault-k8s-auth:t14-vault-k8s-auth
git switch t14-vault-k8s-auth

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master
git merge --no-ff t14-vault-k8s-auth
git switch t14-vault-k8s-auth
git rebase master
git switch master
git merge --ff-only t14-vault-k8s-auth
git switch t14-vault-k8s-auth
git rebase master
git switch master
git merge --no-ff t14-vault-k8s-auth
git switch master
git merge --squash t14-vault-k8s-auth
git switch master
git merge --ff-only t14-vault-k8s-auth
git switch master
git merge t14-vault-k8s-auth
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
needs-info
Waiting on reporter for more information

  
needs-triage
Maintainer needs to evaluate this issue

  
ready-for-agent
Fully specified, ready for an AFK agent

  
ready-for-human
Requires human implementation

  
wontfix
Will not be actioned

No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/iac!30
No description provided.